CVE-2026-44580 Details
Description
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
A cross-site scripting vulnerability has been identified in Next.js, a React framework for full-stack web applications. This issue affects versions 13.0.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5. The vulnerability arises when applications use beforeInteractive scripts with untrusted content, allowing attacker-controlled input to escape the intended script context and execute arbitrary JavaScript in a user's browser. The problem stems from serialized script content not being properly escaped before being added to the document.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5, where this vulnerability is fixed. If an immediate upgrade is not possible, it is advised to avoid passing untrusted data into beforeInteractive scripts or to sanitize or escape the content before embedding it.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 13.0.0, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |